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Abstract 

Quantum algorithms and circuits can, in principle, outper- 
form the best non-quantum (classical) techniques for some 
hard computational problems. However, this does not nec- 
essarily lead to useful applications. To gauge the practi- 
cal significance of a quantum algorithm, one must weigh it 
against the best conventional techniques applied to useful 
instances of the same problem. Graver's quantum search 
algorithm is one of the most widely studied. We identify 
requirements for Graver's algorithm to be useful in prac- 
tice: (1) a search application S where classical methods 
do not provide sufficient scalability; (2) an instantiation of 
Graver's algorithm Q(S) for S that has a smaller asymp- 
totic worst-case runtime than any classical algorithm C(S) 
for S; (3) Q(S) with smaller actual runtime for practical in- 
stances of S than that of any C(S). We show that several 
commonly-suggested applications fail to satisfy these re- 
quirements, and outline directions for future work on quan- 
tum search. 

1 Introduction 

There is growing interest within the electronic design au- 
tomation (EDA) community in quantum mechanics. This 
interest is mostly motivated by the fact that experimen- 
tal transistors have already reached the scale of several 
atoms, where quantum-mechanical effects are not only 
well-pronounced, but can perform useful functions. A 
radical new approach to harnessing these effects suggests 
storing information in quantum states and manipulating 
it using quantum-mechanical operators 1 1 |. Such quan- 
tum states may be carried by electron or nuclear spins 
in molecules, ions trapped in magnetic fields, polariza- 
tions of photons or quantized currents in superconductors. 
Quantum-mechanical operations can be performed by RF 
pulses, optically-active media and single-photon detectors, 
or Josephson junctions. Quantum states are often measured 
by single-photon detectors, e.g., by exciting an ion and forc- 
ing it to emit a photon. Surprisingly, some algorithms in 
terms of quantum states have better worst-case asymptotic 
complexity than best known conventional algorithms. 



The basic unit of quantum information is the qubit 
(quantum bit), conventionally written in the form 
|\|/ >= co|0 > +c\ 1 1 >, where the coefficients cq and c\ are 
complex numbers related to the probability of the qubit be- 
ing or 1. This expression for |\|/ > is interpreted as a su- 
perposition state that is both and 1 simultaneously. A k- 
qubit system can be modeled by a complex-valued vector 
of the form \qi,q2,—:Qk > which denotes a superposition 
of 2 k non-quantum or "classical" states, and implies the 
presence of a kind of massive parallelism in the quantum 
state. This parallelism is a key source of speedup in quan- 
tum computing, but it also makes simulation of such com- 
putations on conventional computers exceedingly difficult. 
In general, mathematical modeling techniques for quantum 
effects entail the use of very large complex-valued matri- 
ces for basic (gate) operations and either state-vectors or 
density-matrices for the quantum states. In a way, complex- 
valued vectors generalize bit-strings, and matrices general- 
ize truth tables. 

While based on very different physics, quantum circuits 
to some extent resemble classical logic circuits, at least in 
the sense that they can be drawn using circuit diagrams. A 
particularly successful application of quantum information 
processing is found in cryptography, and relies on a postu- 
late from quantum mechanics asserting that a quantum state 
is destroyed when it is measured. With additional arrange- 
ments for quantum communication (typically performed by 
sending single photons through fiber optic cable), one can 
guarantee that any attempt to eavesdrop is fruitless and also 
detected. Operational quantum cryptography systems are 
commercially available from MagiQ Technologies in the 
U.S. and IdQuantique in Europe. 

Insights by Feynman, Deutsch, Shor and others suggest 
that massive speed-ups in computing can be achieved by 
exploiting quantum-mechanical effects such as superposi- 
tion (quantum parallelism) and interference Q. A quantum 
algorithm typically consists of applying quantum gates to 
quantum states, but since the input to the algorithm may 
be non-quantum, i.e., normal classical bits, it only affects 
the selection of quantum gates. After all gates are applied, 
quantum measurement is performed and produces the non- 



quantum output of the algorithm. Deutsch's algorithm, for 
instance, solves a certain artificial problem in fewer steps 
than any classical (non-quantum) algorithm can, and its rel- 
ative speed-up grows with the problem size. However, Ben- 
nett et al. have shown in 1 2 1 that quantum algorithms are un- 
likely to solve NP-complete problems in polynomial time, 
although more modest speed-ups remain possible. Shor 
designed a fast (polynomial-time) quantum algorithm for 
number factoring — a key problem in cryptography that is 
not believed to be NP-complete. No classical polynomial- 
time algorithm for number factoring is known, and the prob- 
lem seems so hard that the security of the RSA code used 
on the Internet relies on its difficulty. If a large and error- 
tolerant quantum computer were available today, running 
Shor's algorithm on it could compromise e-commerce. 

Another important quantum algorithm due to Grover 
[l] |4] searches an unstructured "database" to find M 
records that satisfy a given criterion. 1 For any A^-element 
database it takes ~ yJWjM evaluations of the search cri- 
terion (queries to an oracle) on database elements, while 
classical algorithms provably need at least ~ N evaluations 
for some inputs. Despite the promise of the theory, it is by 
no means clear whether, or how soon, quantum-computing 
methods will offer better performance in useful applications 
0. As explained later, traditional complexity analysis of 
Graver's algorithm 0[J@] does not consider the complex- 
ity of oracle queries. The query process is simply treated 
as a "black-box", thus making Graver's algorithm appeal- 
ing because it needs fewer queries than classical search. 
However, with a sufficiently time-consuming query process, 
Graver's algorithm can become nearly as slow as a simple 
(exhaustive) classical search. 

Graver's algorithm must also compete with advanced 
classical search techniques in applications that use parallel 
processing j6| or exploit problem structure, often implicitly. 
In this work, we identify and analyze several requirements 
necessary for Graver's search to be useful in practice: 

1 . A search application S where classical methods do not 
provide sufficient scalability. 

2. An instantiation Q(S) of Graver's search for S with an 
asymptotic worst-case runtime which is less than that 
of any classical algorithm C(S) for S. 

3. A Q(S) with an actual runtime for practical instances 
of S, which is less than that of any C(S). 

We argue that real-life database applications rarely sat- 
isfy Requirement 1. Requirement 2 limits the runtime of 
quantum-oracle queries, and raises subtle hardware design 
issues. Requirement 3 points to approximation algorithms 

'A brief description of Grover's algorithm and its implementation is 
given in the Appendix. 



and heuristics for C(S), as well as fast, adaptive simulation 
of Q(S) on classical computers. We describe a simulation 
methodology for evaluating potential speed-ups of quantum 
computation for specific instances of S. We demonstrate 
that search problems often contain a great deal of structure, 
whose possible use by classical algorithms must be factored 
into the evaluation of Requirements 2 and 3. This analysis 
suggests several directions for future research. 

Section|2]reviews quantum search methods, and Section 
0discusses the scalability issue mentioned in Requirement 

1 for major applications. In Section |4j we study the run- 
time of Grover's search in the context of Requirement 2. 
Section[5]demonstrates that efficient classical simulation of 
quantum search can have runtime which is competitive with 
Grover's algorithm in useful instances. Section[6]provides 
a number of comparisons to classical algorithms that meet 
Requirements 2 and 3. Conclusions and directions for fu- 
ture work on quantum search are summarized in Section^ 

2 Quantum Search 

To search a (large) database used in some particular applica- 
tion S, Grover's algorithm must be supplied with two differ- 
ent kinds of inputs that depend on S: (i) the database itself, 
including its read-access mechanism; and (ii) the search 
criteria, each of which is specified by a black-box predi- 
cate or oracle p(x) that can be evaluated on any record x of 
the database. The algorithm then looks for an x such that 
p{x) = 1. In this context, x can be addressed by a k-bit 
string, and the database can contain up to N = 2 k records. 

Classically, we may evaluate or query /?(•) on one input at 
a time. In the quantum domain, however, if p(-) can be eval- 
uated on either x or y, then it can also be evaluated on the 
superposition (x+y)/^/2, with the result (p(x) + p{y))/y/2. 
This quantum parallelism enables search with queries 
0. If M elements satisfy the predicate, then ^N/M 
queries suffice 0). Note that the parallel evaluation of /?(•) 
requires a superposition of multiple bit-strings at the input, 
which can be achieved by starting in the |00 . . .0) state and 
applying the Hadamard gate H on every qubit. This, of 
course, requires that /?(•) can interpret a bit-string as an in- 
dex of a database record. 

Several variants of Grover's algorithm are known, includ- 
ing those based on quantum circuits and different forms of 
adiabatic evolution. However, as discussed in Q, all are 
closely related to the original algorithm and have similar 
computational behavior. 

For comparison, consider a classical deterministic algo- 
rithm for unstructured search, assuming that parallel pro- 
cessing techniques are not employed 1 6 1 . It requires making 
many queries, because an unsuccessful evaluation of p(x) 
does not, in general, yield new information about records 



other than x. Therefore, one may need anywhere from 1 to 
N queries, depending on the input — N /2 on average. We 
must make queries until one of them is successful, and we 
cannot take advantage of an unsuccessful query. Thus, ev- 
ery deterministic algorithm must visit the database records 
one by one, in some order, and independently try up to 2 k 
database records until a desired record is found. Random- 
ized algorithms can pick records at random, and have an 
edge over deterministic algorithms when many records sat- 
isfy p(-). That is because for any input approximately -^L 
queries suffice with very high probability. However, this 
improvement is not comparable with the quadratic speedup 
offered by Graver's algorithm. 

3 Application Scalability 

While Graver's algorithm relies on quantum mechanics, it 
nevertheless solves a classical search problem and competes 
with advanced classical search techniques in existing as 
well as new applications. Existing applications include Web 
search engines, very large databases for real-time process- 
ing of credit-card transactions, analysis of high-volume as- 
tronomic observations, etc. Such databases explicitly store 
numerous pieces of classical information (records). An- 
other class of existing applications is illustrated by code- 
breaking and Boolean satisfiability, where the input is a 
mathematical function p(x), specified concisely by a for- 
mula, algorithm or logic circuit. One seeks the bits of xf 
such that p(x') = 1, which may represent a correct password 
or encryption key. The database of all possible values of x 
is implicit and does not require large amounts of memory. 

Explicit databases in existing applications are often too 
large to fit in the memory of one computer. They are 
distributed through the network and searched in parallel. 
Records can be quickly added, copied and modified. Dis- 
tributed storage also facilitates redundancy, back-up and 
crash recovery. The records in such databases correspond 
to physical objects (sensors, people or Web pages), and this 
tends to limit typical growth rates of databases. Explicit 
databases may temporarily experience exponential growth, 
as exemplified by the World Wide Web, and yet existing 
search infrastructures appear scalable enough for such ap- 
plications, as illustrated by the continuing success of the 
Web search engine google.com. Graver's algorithm, 
on the other hand, is not well suited to searching explicit 
databases of the foregoing kind because it demands a quan- 
tum superposition of all database records. Creating such a 
superposition, or using a superposition of indices in that ca- 
pacity, seems to require localizing classical records in one 
place, which is impractical for the largest explicit databases. 

Consequently, Graver's search algorithm seems confined 
to implicit databases, where it also faces serious com- 
petition from classical parallel methods (6). This appli- 



cation class includes cryptographic problems, which are 
amenable to classical massively-parallel computation. For 
instance, the DES Challenge II decryption problem has 
been solved in one day by a custom set of parallel pro- 
cessors built by the the Electronic Frontier Foundation and 
distributed, net for $250,000. 

Implicit search applications typically exhibit exponential 
scalability, e.g., adding an extra bit to an encryption key 
doubles the key space. This cannot be matched in princi- 
ple by the linear scalability of classical parallel processing 
techniques (i.e., adding hardware). Therefore, we believe 
that these applications meet Requirement 1, and thus are 
potential candidates for practical quantum search tasks. 

4 Oracle Implementation 

Although the oracle function /?(•) in Graver's algorithm can 
be evaluated on multiple inputs simultaneously, the descrip- 
tion of p(-) is usually left unspecified |3][T]Q]. To actually 
implement Graver's algorithm for a particular search prob- 
lem, one must explicitly construct p(-). Several pitfalls are 
associated with this important step, and are related to the 
complexity of /?(•). 

The first problem is that to query /?(■) using quantum par- 
allelism, one must implement p(-) in quantum hardware. 
This hardware can take a variety of different logical and 
physical forms (0- If a quantum implementation of /?(•) is 
derived from classical hardware design techniques, the cir- 
cuit size of the classical and quantum implementations may 
be similar. Circuit size is estimated by the number of logic 
operations (gates) employed, and computation time by the 
maximum depth of the circuit. However, if these numbers 
for an AMtem database scale much worse than \J~N, then 
both classical and quantum searching will be dominated by 
the evaluation of p(-), diminishing the relative value of the 
quantum speed-up on the log-scale. 

A more subtle problem is the complexity of designing 
hardware implementations of p(-). Even if a given p(-) can 
theoretically be implemented without undermining the rel- 
ative speed-up of Graver's algorithm, there may be no prac- 
tical way to find compact classical or quantum implemen- 
tations in a reasonable amount of time. In classical elec- 
tronic design automation (EDA), finding small logic circuits 
is an enormously difficult computational and engineering 
task that requires synergies between circuit designers and 
expensive design software. Automatic synthesis of small 
quantum circuits appears considerably harder as some for- 
mulations allow gates whose function depends on continu- 
ous parameters |8|, rendering discrete methods irrelevant. 

While Requirement 2 is satisfied by Graver's algorithm 
in principle, satisfying it by a significant margin on the log- 
scale may be difficult in many cases because a small-circuit 
implementation of the oracle-function p(-) may not exist, 
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Figure 1: A 5-qubit state- vector in the QuIDD data struc- 
ture. Each decision variable /?, corresponds to a bit i in 
the binary encoding of indices in the vector. Dashed lines 
model Os assigned to the index bit, and solid lines model Is. 
Top-down paths represent the 32 entries of the state-vector; 
a path may capture multiple entries with equal values. 

or may require an unreasonable effort to find. 

5 Classical Simulation 

As in the case of Graver's algorithm, quantum computa- 
tion is often represented in the quantum-circuit formalism, 
which is described mathematically using linear algebra Q. 
Qubits are the fundamental units of information; £-qubit 
quantum states can be represented by 2*-dimensional vec- 
tors, and gates by square matrices of various sizes. The par- 
allel composition of gates corresponds to the tensor (Kro- 
necker) product, and serial composition to the ordinary ma- 
trix product. Like classical circuits, quantum circuits can 
be conveniently simulated by computer software for anal- 
ysis or design purposes. A quantum circuit can be sim- 
ulated naively by a sequence of 2 k x 2 i -matrices that are 
applied sequentially to a state vector. This reduces quan- 
tum simulation to standard linear algebraic operations with 
exponentially sized matrices and vectors. Measurement is 
simulated similarly. Since Graver's algorithm only requires 
k qubits for a database of N = 2 k records, it is clear that a 
naive classical simulation of Graver's algorithm would be 
exponentially worse than an actual quantum circuit that im- 



plemented the algorithm. 

The linear-algebraic formalism does not differentiate be- 
tween structured and unstructured data. However, the state 
vectors and gate matrices that appear in typical quantum 
simulations are anything but unstructured. In particular, 
they compress very well when simulated using the QuIDD 
data structure (9). A QuIDD is a directed acyclic graph 
with one source and multiple sinks, where each sink is la- 
beled with a complex number. Matrix and vector elements 
are modeled by directed paths in the graph, as illustrated 
in Figure^ Linear-algebraic operations can then be imple- 
mented by graph algorithms in terms of compressed data 
representations. The use of data-compression may substan- 
tially reduce simulation runtime for specific applications, 
especially those dealing with non-random data and circuits. 
This suggests a test-by-simulation approach to identify vi- 
olations of Requirement 3. Indeed, polynomial-time simu- 
lation techniques were proposed for circuits with restricted 
gate types 1101 II II and for "slightly entangled" quantum 
computation 1121 . However, these results have not been ap- 
plied to quantum search. 

We have found that QuIDDs enable a useful class of 
quantum circuits to be simulated using time and mem- 
ory that scale polynomially with the number of qubits |9|. 
All the components of Graver's algorithm, except for the 
application-dependent oracle, fall into this class. In fact, 
we have also proven that a QuIDD-based simulation of 
Graver's algorithm requires time and memory resources 
that are polynomial in the size of the oracle p(-) function 
represented as a QuIDD |9|. Thus, if a particular p(-) for 
some search problem can be represented as a QuIDD using 
polynomial time and memory resources (including conver- 
sion of an original specification into a QuIDD), then clas- 
sical simulation of Graver's algorithm performs the search 
nearly as fast as an ideal quantum circuit. If a practical 
implementation of an oracle function p(-) is known, it is 
straightforward to represent it in QuIDD form, since all rel- 
evant gate operations are defined for QuIDDs. Once /?(•) is 
captured by a QuIDD, a QuIDD-based simulation requires 
y/N/M queries, just like an actual quantum computer |9|. 
If the size of the QuIDD for p(-) scales polynomially for 
£-qubit instances of the search problem, then Graver's al- 
gorithm offers no speed-up for the given search problem. 

We implemented a generic QuIDD-based simulator 
called QuIDDPro in the C++ programming language |9|. 
This simulator can be used in practice to perform the test by 
simulation just described. Figure |2]presents runtime results 
for QuIDDPro simulating Graver's algorithm for the search 
problem considered in the seminal paper by Graver [31 . The 
oracle function for this search problem returns p(x) = 1 for 
one item in the database. In all such cases, the QuIDD for 
/?(•) has only k nodes, and QuIDD-based simulation is em- 
pirically as fast as an actual quantum computer. Memory 
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Figure 2: For k qubits, an actual quantum computer imple- 
menting Graver's algorithm must perform at least ck(^/2) k 
steps where c is a constant. For the type of predicates origi- 
nally considered by Graver 0, empirical runtime of QuID- 
DPro simulation fits very well to this formula (plotted on a 
log-log scale), and the value of c is small. 

usage is only a few megabytes and grows linearly with the 
number of qubits J9). Hence this particular search problem 
fails to meet Requirement 3, and so does not benefit by be- 
ing implemented on a quantum computer. 

Predicates exist that do not compress well in QuIDD 
form, and so require super-polynomial time and memory 
resources. However, some of these predicates may also re- 
quire a super-polynomial number of quantum gates. This 
may cause the evaluation of p(x) to dominate the runtime 
of quantum search and undermine the speed-up of Graver's 
algorithm over classical search. 

6 Problem-Specific Algorithms 

As discussed above, comparisons between quantum and 
classical search algorithms often implicitly make strong as- 
sumptions, namely the unrestricted use of black-box pred- 
icates and the misconception that no quantum circuit can 
be simulated efficiently on any inputs. These assump- 
tions overestimate the potential speed-up offered by quan- 
tum search. Another, and perhaps, more serious oversight 
in popular analysis concerns the structure present in partic- 
ular search problems. We show next that one must com- 
pare Graver's algorithm against highly-tuned classical al- 
gorithms specialized to a given search problem, rather than 
against generic exhaustive search. 

Boolean 3-satisfiability and graph 3-coloring have been 
suggested as possible applications of quantum search be- 
cause polynomial-time algorithms are not known for these 
NP-complete problems, and are unlikely to be found. There 
are, however, classical algorithms I13I 1 141 which solve 



these two problems in less than ~ poly(k) 1.34* and ~ 
poly{k)\31 k steps, respectively (k is the number of vari- 
ables), thereby outperforming quantum techniques that re- 
quire at least ~ poly{k)\A\ k steps. 2 The algorithms in 
1731 1141 exploit subtle structure in problem formulations, 
and so have the potential for further improvement. No such 
improvement is possible for Graver's algorithm unless ad- 
ditional assumptions are made 1151 . as in Q. 

Of course, many practical NP-complete search prob- 
lems remain whose best known upper bounds far ex- 
ceed ~ poly(k)\Al k — for example, ^-satisfiability and 
^-coloring, with k > 4. However, known classical al- 
gorithms often finish much faster on certain inputs, both 
application-derived and artificial, structured and unstruc- 
tured 1161 . Indeed, one can now solve randomly-generated 
hard-to-satisfy instances of Boolean satisfiability with a 
million variables in one day, using a single-processor PC. 
Graver's algorithm is mainly sensitive to the number of so- 
lutions, but not to the solutions themselves and not to input 
features (such as symmetries) that are sometimes exploited 
by classical algorithms. 

The Euclidean traveling salesman problem (TSP) and 
many other geometric optimization problems have defied 
fast exact algorithms so far, but can often be solved using 
polynomial-time approximation schemes that trade off ac- 
curacy for runtime 1 1 71 . Their geometric structure allows 
one to solve these problems to a given precision e > in 
polynomial time. Additionally, specific very large instances 
of such problems have been solved optimally in the past, 
e.g., the TSP for over 10,000 cities. Opportunistic algo- 
rithms and heuristics that work well only on some inputs 
are very useful in practice, but comparable quantum heuris- 
tics are poorly understood. 

Hard cryptography problems have also been mentioned 
as potential applications of Graver's algorithm 1 6 1. They in- 
clude code-breaking (particularly, the DES and AES cryp- 
tosystems) and reversing cryptographically-secure hash- 
functions (MD5 and SHA-1). Indeed, these can be cast 
as unstructured search algorithms, but cryptographers have 
identified structure in all such applications. The task of 
breaking DES has been reduced to Boolean 3-satisfiability 
1181 and clearly does not require a naive enumeration of 
keys. "Essential algebraic structure" |19| has been identi- 
fied in AES, which has recently replaced DES as the US en- 
cryption standard. Similarly, publications surveyed in 1201 
suggest that all major crypto-hashes have well-pronounced 
structure. In fact, past discoveries of unexpected types 
of structure in crypto-hashes MD-2, MD-4, RIPEMD and 



2 The algorithm analyzed in 1131 is a simplified version of the well- 
known WalkSAT program. It is a type of randomized local search where 
variable assignments are changed one at a time so as to statistically de- 
crease the number of unsatisfied clauses. Randomization in the algorithm 
facilitates hill-climbing and an extremely fast move selection mechanism. 



SHA were so significant that those functions are no longer 
considered cryptographically secure. 

In summary, to evaluate the potential benefits of an im- 
plementation of Graver's algorithm, one must compare it 
with the best known classical problem-specific algorithms 
taking exploitable structure into account. The comparison 
is straightforward if the search problem has been studied 
previously, as in the case of Boolean satisfiability, graph 
coloring, the traveling salesman problem, and various code- 
breaking tasks. However, even if no optimized classical al- 
gorithm has yet been devised for a particular search prob- 
lem, the problem may still contain a great deal of implicit 
and exploitable structure. 

7 Conclusions 

While quantum computing has dramatically advanced 
through the last decade, its potential applications have not 
yet been demonstrated at full scale. Such demonstrations 
are likely to require breakthroughs in physics, computer sci- 
ence and engineering Q. Additionally, it is important to 
understand current roadblocks to achieving practical speed- 
ups with quantum algorithms. To this end, we have ana- 
lyzed the potential of Graver's search algorithm to compete 
with classical methods for search, and identified three re- 
quirements for it to be practically useful. They serve to 
highlight several specific obstacles and pitfalls in imple- 
menting and analyzing quantum search, e.g., ignoring the 
implementation complexity of the query process. We have 
also demonstrated the usefulness of classical simulation in 
evaluating quantum algorithms and their implementation. 
Our hope is that this work will temper unreasonable expec- 
tations of quantum speed-ups and encourage further study 
of ways to improve quantum search. 

In the near term, quantum computers running Graver's 
algorithm are unlikely to be competitive with the best clas- 
sical computers in practical applications. Adding to the 
arguments of J6) regarding classical parallelism, we have 
pointed out that recent work on solving "intractable" prob- 
lems such as Boolean satisfiability and direct simulation 
of quantum circuits, offers opportunities to exploit subtle 
domain-specific structures, even on a single classical pro- 
cessor. Despite their exponential worst-case runtime, some 
of these algorithms are always faster than Graver's search. 

We list some interesting open research issues that deserve 
attention: 

1. Applications of search where classical methods do not 
offer sufficient scalability. 

2. Algorithms for near-optimal synthesis of quantum or- 
acle circuits. 



3. Quantum heuristics that finish faster or produce better 
solutions on practical inputs. 

4. Quantum algorithms that exploit the structure of useful 
search problems. 

Recent work on variants of Graver's search that account 
for problem structure seems particularly promising. Build- 
ing up on earlier proof-of-concept results, Roland and Cerf 
1211 compare the fastest known classical algorithms for 3- 
satisfiability 1131 to their quantum search algorithm cog- 
nizant of the 3-literal limitation. Their analysis shows 
that the quantum algorithm has a smaller asymptotic ex- 
pected runtime, averaged over multiple SAT instances with 
a particular clause-to-variable ratio (at the phase-transition), 
which are known to be the most difficult to solve on average. 
Similar comparisons for worst-case asymptotic runtime re- 
main an attractive goal for future research. 

Several considerations in our work are not restricted to 
Graver's search and apply to other potential applications of 
quantum computing. For example, the graph automorphism 
problem that seeks symmetries of a given graph is some- 
times suggested as a candidate for polynomial-time quan- 
tum algorithms Q- Classically this problem appears to re- 
quire more than polynomial time in the worst case, while 
unlikely to be NP complete, just like number-factoring. 
However, graph automorphism is provably easy for ran- 
dom graphs and can also be solved quickly in many practi- 
cal cases, e.g., in the context of microprocessor verification 
1221 . making existing algorithms and software strong com- 
petitors of potential future quantum algorithms. 

A novel application of quantum algorithms to finding 
template matches in photographs was proposed in 1231 . 
but relies on the quantum Fourier transform rather than 
Graver's search. Proposals of this kind also deserve care- 
ful evaluation from the computer engineering perspective 
and must be compared to state-of-the-art classical methods 
on realistic inputs. 
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Appendix: Description of Grover 's 
Quantum Search Algorithm 

Graver's quantum algorithm searches for a subset of items 
in an unstructured set of N items 1 3 1. The algorithm incor- 
porates the search criteria in the form of a black-box pred- 
icate that can be evaluated on any items in the set. The 
complexity of this evaluation (query) varies depending on 
the search criteria. With conventional algorithms, search- 
ing an unstructured set of N items requires Q.(N) queries in 
the worst case. In the quantum domain, however, Graver's 
algorithm can perform unstructured search by making only 
0(\/N) queries, a quadratic speed-up over the classical 
case. This improvement is contingent on the assumption 
that the search predicate can be evaluated on a superposi- 
tion of all database items. Additionally, converting classical 
search criteria to quantum circuits often entails a moderate 
overhead, and the complexity of the quantum predicate can 
offset the reduction in the number of queries. 

A high-level circuit representation of Graver's algorithm 
is shown in Figure [3] The first step of the algorithm is to 
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Figure 3: A high-level circuit depiction of Graver's quantum search algorithm, 
circuits can be found in 1 1 1 and |9|. 



More detailed 



initialize log(N) qubits, each with a value of |0). These 
qubits are then placed into an equal superposition 3 of all 
values from to N — 1 (encoded in binary), by applying 
one Hadamard gate on each input qubit. Since the super- 
position contains bit-strings, they are thought of as indices 
to the N items in the search space rather than as the items 
themselves. 

The next step is to iteratively increase the probability am- 
plitudes of those indices in the superposition that match 
the search criteria. The key component of each iteration 
is querying the black-box predicate. The predicate can be 
viewed abstractly as a function f(x) which returns 1 if the 
index x matches the search criteria and returns otherwise. 
Assuming that the predicate can be evaluated on the super- 
position of indices, a single query then evaluates the predi- 
cate on all indices simultaneously. In conjunction with ex- 
tra gates and qubits ("workspace qubits"), the indices for 
which f(x) = 1 can be marked by rotating their phases by 
K radians. To capitalize on this distinction, additional gates 
are applied so as to increase the probability amplitudes of 
marked indices and decrease the probability amplitudes of 
unmarked indices. Mathematically, this transformation is a 
form of inversion about the mean. It can be illustrated on 
sample input {-1/2, 1/2, 1/2, 1/2} with mean 1/4, where in- 
version about mean produces {1,0,0,0}. Note that both vec- 
tors in the example have norm 1, and in general inversion 



3 An equal superposition means that all possible states represented by 
the superposition have equal probability amplitudes. The square of the 
probability amplitude associated with a particular bit-string is the proba- 
bility with which that bit-string will be observed after a quantum measure- 
ment. 



about mean is a unitary transformation. One of Graver's 
insights was that it can be implemented with fairly small 
quantum circuits. 

In the case when only one element out of N satis- 
fies the search criterion each iteration of Graver's algo- 
rithm increases the amplitude of this state by approximately 
0(1 /VN)- Therefore, on the order of ^/N iterations are re- 
quired to maximize the probability that a quantum measure- 
ment will yield the sought index (bit-string). For the more 
general case with M elements satisfying the search crite- 
ria, the optimal number of iterations is shown in |4 | to be 

„ n arcsin{\/M IN) t 111 1 ^ ,1 

R = ^ — ■ — -. It can also be shown that Grover s algo- 
rithm exhibits a periodic behavior and after the amplitudes 
of sought elements peak, they start decreasing. 

The final step is to apply a quantum measurement to 
each of the log(N) qubits. Postulates of quantum mechan- 
ics posit that measurement is probabilistic and collapses the 
superposition to a single bit-string — the larger the ampli- 
tude of a bit-string, the more likely the bit-string is to be 
observed. 

When M items match the search criteria in a particular 
search problem, then Graver's algorithm produces one of 
them. Each item is equally likely to appear because the 
inversion about the mean process increases the probability 
amplitudes of matching items equally. If all such items must 
be found, Graver's algorithm may have to be repeated more 
than M times, potentially returning some items more than 
once. On the other hand, classical deterministic search tech- 
niques avoid such duplication and may be more suitable in 
applications where M is a significant fraction of N. 



